Webhook

What is a webhook?

A webhook is a way for one system to notify another that something has happened. You give the source application a URL, often called an endpoint, and choose which events you care about. When one of those events occurs, the application sends an HTTP request to that URL with a payload describing the event, usually in JSON.

For example, a payment provider can send a webhook to your system when a charge succeeds, fails or is refunded. Your system receives it, checks it is genuine, and updates the order, sends a receipt or alerts the finance team.

Webhooks are sometimes called "reverse APIs". With a standard API integration, your system asks for data; with a webhook, the other system tells you when something changes. They show up in payments, ecommerce platforms, CRMs, form builders, code repositories and support tools, and they are the usual trigger for workflow automation that needs to react in near real time.

How is a webhook different from polling an API?

Polling means asking a system on a schedule whether anything has changed. It is simple, but wasteful: most checks return nothing new, each one uses up API limits, and changes are only picked up at the next check.

A webhook reverses the direction. The source system sends the update when the event happens, so the receiver reacts within seconds and makes no unnecessary calls. That makes webhooks the better fit for time-sensitive events, such as payments, new leads or order status changes.

The trade-off is reliability. If your endpoint is down when a webhook is sent, you may miss the event unless the sender retries. Many teams combine the two: webhooks for speed, plus a periodic check against the API to catch anything that was missed.

How do you secure webhooks?

A webhook endpoint is a public URL, so anyone who finds it could send fake events. A few standard practices protect it:

• Verify signatures: most providers sign each payload with a shared secret; check the signature before trusting the data.
• Use HTTPS only, so payloads are encrypted in transit.
• Check timestamps to reject old messages replayed by an attacker.
• Keep payloads minimal and fetch sensitive details from the API instead of trusting the webhook body.
• Rotate secrets and restrict who can view or change webhook settings.

Payloads can contain personal or payment data, so logging and storage should follow the same data security rules as the rest of your systems.

What can go wrong with webhooks?

Webhooks are simple to set up and easy to get subtly wrong. The common problems:

• Duplicates: senders often retry, so the same event can arrive more than once. Make processing idempotent, meaning a repeated event has no extra effect.
• Order: events can arrive out of sequence, for example an update before the create.
• Timeouts: if the receiver does slow work before responding, the sender may treat it as a failure and retry. Acknowledge quickly and process in a queue.
• Silent failures: an expired endpoint or a changed URL can stop events without anyone noticing.

Logging every received event, alerting on failures and running a regular reconciliation against the source system catch most of these issues before they reach customers or reports.

What are webhooks used for in business?

Webhooks are the glue for event-driven operations. Typical uses:

• Sending a new form submission straight into the CRM and alerting the right salesperson.
• Updating orders, inventory and accounting when an ecommerce order is paid, shipped or refunded.
• Triggering onboarding emails when a user signs up for a product.
• Opening a support ticket or chat alert when a monitoring tool detects an error.
• Syncing subscription status from the billing tool to the product, so access changes when a payment fails.
• Feeding events into a warehouse for real-time analytics.

In each case, the webhook only delivers the news. The value comes from what the receiving system does next, so design the downstream workflow, including its error handling, as carefully as the webhook itself.

How does Vizio AI use webhooks?

Webhooks are a building block in the API and systems integrations and workflow automations our DX Studio builds. We use them to connect the CRM, finance, marketing, product and support tools a business already uses, so events trigger the next step right away. We design the receiving side properly: signature checks, queues, duplicate handling, logging and alerts, plus a reconciliation job where data has to be complete.

We support these integrations after launch, as vendors change their events and payloads. A good starting point is listing the events your team currently waits on or checks by hand, and deciding which ones should trigger work automatically.